Microsoft Issues Security Alert on IIS Web Server

Responding to public reports of a wild bug, Microsoft on late Monday issued a security advisory to address a potential vulnerability in its Internet Information Services (IIS) Web server software.

Redmond said that the vulnerability, which has elevation of privilege implications, pertains to IIS versions 5.0, 5.1 and 6.0. The software giant added that it wasn't aware at this time of any "known attacks" against IIS, but is investigating the matter. IIS is the world's most frequently used Web server, after Apache HTTP server.

Independent security researchers first uncovered evidence of the bug late last week. On Monday, the U.S. Computer Emergency Readiness Team (U.S. CERT) confirmed that there were indeed threats to IIS.

In its advisory, Microsoft identified three "mediating factors" that can serve as workarounds for the vulnerability until its own investigation is concluded and a new patch is issued.

First, Microsoft recommends that system administrators maintain file system access control lists (ACL) that are solid and enforceable. With a clamp down on access control security, the elevation of privilege problem is lessened. Microsoft explains that under such conditions, "this vulnerability cannot be used to exceed the level of access granted to the anonymous user account through file system ACLs."

The second workaround involves configuring orphan, anonymous or administrative user accounts to deny write, change or delete privileges by default. That way, an anonymously listed "SECADMIN" or "SYSADMIN" user profile can't be used against an organization.

The final mitigation trick involves disabling Web-based distributed authoring and versioning (WebDAV). Microsoft's advisory says that this workaround particularly works for Windows Server 2003 systems running IIS 6.0. The advisory adds that for IIS 6.0, "WebDAV is not enabled in the default configuration" and unless enabled by an administrator, the system remains relatively unexposed.

Shavlik Technologies' Chief Technology Officer Eric Schultze offered one note of caution for IT pros studying this vulnerability.

"This flaw could enable attackers to read code pages on the Web server, where these pages might include usernames or passwords for applications or databases controlled by the Web server," Schultze said in a prepared statement. "I recommend people running IIS 5 or IIS 6 run the IIS lockdown and URLScan tools from Microsoft. Both of these tools disable WebDAV and will protect your system from this latest zero day."

Such vulnerabilities have appeared and been patched before in IIS. In February of 2008, Redmond issued two patches to address elevation of privilege and remote code execution bugs in IIS. Back then, it was said an attacker could take control of an IIS server by way of the Worker Process Identity application, which is preset with network admin account privileges by default.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus


  • Creating a Progressive Web App with Blazor WebAssembly

    Not surprisingly, it's dead easy to create an app in Blazor that runs outside of the browser window and (potentially) in an offline mode. Before you get carried away, though, there are some key design decisions to make.

  • GitLab Takes Over VS Code Extension, Plans Improvements

    DevOps specialist GitLab has officially taken over the control of a GitLab extension for Microsoft's open source, cross-platform Visual Studio Code editor.

  • VS Code Python Tool Now Does Native Notebooks

    The Python Extension for VS Code Insiders team is previewing the newest implementation of notebooks, used frequently in data science with offerings such as Jupyter Notebooks.

  • As .NET 5 Nears, Content/Documentation Reorganization Starts

    A GitHub project is seeking to reorganize documentation and developer content in advance of the November debut of .NET 5, a unification of all things .NET that combines. .NET Core and other components.

  • Windows Devs Get Cross-Platform Page, Issues Repo

    Developers doing their coding on the Windows OS have received two new resource gifts from Microsoft: a new landing page for those using cross-platform technologies and a new GitHub repo with which to report issues to Windows engineering teams.Developers doing their coding on the Windows OS have received two new resource gifts from Microsoft: a new landing page for those using cross-platform technologies and a new GitHub repo with which to report issues to Windows engineering teams.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events